Stock Recovery strace Analysis
Source: /system/bin/recovery from firmware/na1-stock-recovery.img ramdisk, run in chroot on TWRP v2.5. Raw log: firmware/strace-stock-recovery.log (3268 lines).
Display Initialization — Authoritative Sequence
| Step | Syscall | fd | Detail |
|---|---|---|---|
| 1 | openat("/dev/graphics/fb0", O_RDWR|O_CLOEXEC) | 0 | Main fb0 handle |
| 2–3 | ioctl(FBIOGET_FSCREENINFO / VSCREENINFO) | 0 | Read screen params |
| 4 | mmap(21209088, MAP_SHARED) | 0 | Full double-buffer (7552×2808) |
| 5–8 | Open fb0 again → read geometry → close | 12 | ebc helper (geometry only) |
| 9 | openat("/dev/ebc", O_RDWR) | 12 | EPDC control device |
| 10 | mmap(10513152, MAP_SHARED) | 12 | ebc pixel buffer (7488×1404, pixel-exact) |
| 11 | ioctl(12, 0x700c) EBC_SEND_UPDATE | 12 | Init/clear — BEFORE blank |
| 12 | ioctl(0, FBIOBLANK, 4) | 0 | FB_BLANK_POWERDOWN |
| 13 | ioctl(0, FBIOBLANK, 0) | 0 | FB_BLANK_UNBLANK |
| 14–15 | ioctl(12, 0x700c) EBC_SEND_UPDATE ×2 | 12 | Content updates |
What stock code does NOT do
FBIOPUT_VSCREENINFO— never calledFBIOPAN_DISPLAY— never called- Any sysfs writes to EPDC nodes
EBC_WAIT_UPDATE(0x700d) — not during initEBC_CLEAR(0x700e) — never called
Critical Finding: Stock Binary Also Failed in TWRP Environment
When the stock recovery binary was run in a chroot inside TWRP (with TWRP process SIGSTOP’d), it completed its full display init sequence but produced no visible display change. This proved definitively that the display problem was NOT a userspace ioctl issue — the problem was in the kernel boot environment (missing waveform firmware file at /waveform/eink_waveform.wbf). See Research: A2 Waveform Mode for the root cause and fix.
Input Device Map
| Device | Identity | TWRP use |
|---|---|---|
| event0 | Power + Back button (KEY_POWER, KEY_BACK) | Use |
| event1 | Capacitive touchscreen — MT type B (ABS_MT_SLOT, POSITION_X/Y, TRACKING_ID) | Primary input |
| event2 | EMR Wacom stylus (ABS_X/Y/PRESSURE/DISTANCE, BTN_TOOL_RUBBER/BRUSH) | Blacklist |
| event3 | USB/BT mouse (BTN_LEFT, BTN_RIGHT) | Optional |
| event4 | Virtual keys / GPIO (KEY_ENTER, KEY_HOME, KEY_UP…) | Ignore |
| event5 | Hall sensor (KEY_LEFTALT, KEY_POWER, KEY_WAKEUP) | Blacklist |
| event6 | Volume up (KEY_VOLUMEUP) | Ignore |
Other Operations
- Brightness: writes 127 to
/sys/class/leds/lcd-backlight/brightness(LED class path, different from TWRP’s direct i2c path) - Zeros 2048 bytes of misc partition (clears BCB on every recovery boot)
- Mounts /cache (ext4,
/dev/block/mmcblk0p12) - Opens
/dev/kmsgfor dual logging - Spawns 3 threads: logging, property reader, screen update